Many will no doubt pore over the Supreme Court’s recent judgment in Elgizouli v Secretary of State for the Home Department to evaluate its significance for the common law constraint of prerogative power. Ultimately, however, the Supreme Court held that it was not the common law but rather a failure by the Home Secretary to consider his duties under the Data Protection Act 2018 that rendered the decision in question unlawful. This post considers the significance of the Data Protection Act 2018 for protecting the fundamental rights and freedoms of data subjects. Although the narrow ground upon which the judgment was decided will offer some procedural protections for fundamental rights and freedoms, the case’s significance lies in its suggestion as to how data protection law might offer some scope for extending the extraterritorial application of human rights beyond the limits of the European Convention on Human Rights.

The case concerned the Home Secretary’s decision to provide mutual legal assistance to the United States to facilitate a prosecution in the US for offences that carried the death penalty, without receiving assurances that the death penalty would not be imposed or, if imposed, would not be carried out. The appellant’s son and another individual were suspected of crimes committed in Syria, including the murder of 27 people in recorded beheadings which were subsequently posted online. The mutual legal assistance in question concerned the transfer of evidence obtained by British authorities to the US under the UK-US Mutual Legal Assistance Treaty 1994.

It was not a common law constraint on facilitating the death penalty but rather the Data Protection Act 2018 that rendered such assistance unlawful. The Supreme Court rejected the Home Secretary’s argument that compliance with the substance of the Data Protection Act 2018 was sufficient. Rather, the Act “required a conscious, contemporaneous consideration of whether the [statutory] criteria for [the transfer] were met” [Lady Hale, paragraph 6].

Part 3 of the Data Protection Act 2018 deals with law enforcement processing. It seeks to implement the EU Law Enforcement Directive (Directive (EU) 2016/680). The relevant transfer consisted of processing personal data for a law enforcement purpose by a controller who was also a “competent authority” within the scope of Part 3.

Section 73 of the Data Protection Act 2018 imposes conditions on the transfer of personal data to a third country for law enforcement purposes. Disagreement in the case focussed on the second condition in section 73, that the transfer, in the absence of an “adequacy decision” or “appropriate safeguards”, is “based on special circumstances”. Section 76(1) provides that a transfer of personal data to a third country is “based on special circumstances where the transfer is necessary” for one of a list of purposes. The relevant circumstances were section 76(1)(d) (“in individual cases for any of the law enforcement purposes”) and section 76(1)(e) (“in individual cases for a legal purpose”). Importantly, neither subsection applies “if the controller determines that fundamental rights and freedoms of the data subject override the public interest in the transfer” [section 76(2)]. Reliance on section 76(1) must also be documented [section 76(3)].

Lord Carnwath explained that section 73 requires “specific consideration by the relevant controller of the statutory tests” including a “strict test of necessity” [paragraph 219]. The “clear purpose” of the section was to “set out a structured framework for decision-making, with appropriate documentation” [paragraph 219]. It was the absence of this structured decision-making and documents that breached the Act. There had been no consideration as to whether the transfer was strictly necessary under the statutory criteria [paragraphs 226 and 227].

This narrow ground for holding that the Home Secretary’s decision was unlawful is a helpful procedural protection. The Home Secretary must give specific consideration to the statutory tests and document the decision, which ensures careful consideration of the necessity of the transfer. However, it is not at all clear that the Home Secretary’s decision would have differed had he given specific consideration to the relevant statutory tests. There are limited remedies after data has been unlawfully transferred. The transfer itself cannot be undone, although enforcement action may be taken by the Information Commissioner’s Office under sections 149 (enforcement notices) and 155 (penalty notices) of the Data Protection Act 2018. The data subjects might also seek compensation under section 169 of the 2018 Act.

The Supreme Court did not decide whether a transfer could nevertheless be made in compliance with section 76. This is importantly different from Lord Kerr’s dissenting analysis, which was rejected by the other judges. He had concluded that the decision was unlawful both at common law and under the Act, and would not have permitted a transfer without appropriate assurances [paragraphs 146 and 158], in contrast to the narrower approach taken to the common law by the majority.

It is the broader potential of the case for future litigation on the extra-territorial protection of fundamental and human rights that is most interesting. Data protection law has often taken a back seat in UK litigation to the Human Rights Act 1998 when dealing with information, especially Article 8 ECHR, the right to private and family life. Elgizouli highlights the potential of data protection legislation to extend human rights protections beyond the territorial confines of the European Convention on Human Rights.

The individuals concerned in Elgizouli were not, at the time of the relevant transfer of information, British citizens. One of those individuals had been deprived of his citizenship as “conducive to the public good” under section 40(2) of the British Nationality Act 1981. Indeed, a key attraction of the argument for a common law prohibition on the facilitation of the death penalty was that it would be capable of application “regardless of the location of any individual” [Lord Kerr, paragraph 70]. The European Convention on Human Rights requires individuals to be within the jurisdiction of the UK at the time of the alleged violation in order to benefit from its protections. That jurisdiction is largely territorial. Lord Kerr explained that this might be the “practical reason” why Strasbourg jurisprudence has not addressed the non-facilitation of the death penalty beyond the context of extradition or expulsion [paragraphs 68 and 69].

Lady Hale considered the broader implications of section 76 in her judgment. She observed that the fundamental rights and freedoms of the data subject referred to in section 76(2) must include the rights in the European Convention on Human Rights [paragraph 13]. This was because recital 46 of the Law Enforcement Directive requires compliance with the European Convention on Human Rights “and in particular the essence of those rights” for any restriction on data subjects’ rights [Lady Hale, paragraph 13]. Had it been necessary to do so, Lady Hale indicated that she would have been prepared to hold that section 76(2) “would not allow the transfer of personal data to facilitate a prosecution which could result in the death penalty” [paragraph 15]. Lord Carnwath and Lord Hodge both noted the force of Lady Hale’s analysis on this point, but observed that it had not been fully argued by the parties, and therefore they did not express a settled view on the analysis [paragraphs 228 and 230 respectively].

The real significance of Elgizouli might therefore be not in its analysis of the common law but in pointing the way towards defending the human rights of data subjects by challenging international data transfers that facilitate the violation of those rights. Such an analysis, if later accepted on fuller argument, may facilitate greater rights protections beyond the territorial limitations of the European Convention on Human Rights.

Dr Oliver Butler is a Fellow of Wadham College, University of Oxford and a Research Fellow at the Bonavero Institute of Human Rights.

Suggested citation: O. Butler, ‘Elgizouli v Secretary of State for the Home Department: The Fundamental Rights and Freedoms of the Data Subject’, U.K. Const. L. Blog (17th April 2020) (available at https://ukconstitutionallaw.org/))